SAP-C02 Practice Test 24 — 15 Questions

Question 1

A company is designing a new microservices architecture using AWS Lambda. Each microservice has its own database. The company wants to securely store database credentials and rotate them automatically. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option C is correct. AWS Secrets Manager supports automatic rotation of secrets. Option A is wrong because Parameter Store does not have built-in rotation. Option B is wrong because IAM is for access management, not secret storage. Option D is wrong because KMS is for encryption keys, not secrets.

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Answer

AWS Identity and Access Management (IAM)

Question 2

A company is designing a new VPC with public and private subnets. The company wants to ensure that instances in the private subnets can download updates from the internet, but cannot be directly accessed from the internet. Which THREE components are required to meet these requirements? (Choose THREE.)

Accepted Answer

A route table for private subnets with a default route pointing to the NAT Gateway.. The correct answers are A, B, and C. Option A is correct because an Internet Gateway allows outbound traffic to the internet. Option B is correct because a NAT Gateway provides outbound internet access to instances in private subnets. Option C is correct because the route table for private subnets must point to the NAT Gateway for default route. Option D is wrong because a Virtual Private Gateway is used for VPN connections, not internet access. Option E is wrong because VPC endpoints are for private access to AWS services, not for internet access.

Answer

A Virtual Private Gateway (VGW).

Answer

A VPC endpoint for S3.

Question 3

A company is designing a new web application that will run on Amazon EC2 instances behind an Application Load Balancer. The application must be highly available across multiple Availability Zones. Which TWO actions should the architect take? (Choose TWO.)

Accepted Answer

Configure the ALB as internet-facing and attach it to multiple Availability Zones.. For high availability, the ALB must be internet-facing (option B) and EC2 instances should be in multiple AZs (option C). Option A (single AZ) is not HA. Option D (NLB) is not needed. Option E (public IPs) is unnecessary.

Answer

Launch all EC2 instances in a single Availability Zone.

Answer

Use a Network Load Balancer instead of an Application Load Balancer.

Answer

Assign Elastic IP addresses to each EC2 instance.

Question 4

A company is designing a disaster recovery solution for a critical application that runs on Amazon EC2 instances in a single AWS Region. The application uses an Amazon RDS for MySQL database. The company wants to achieve a recovery point objective (RPO) of 5 seconds and a recovery time objective (RTO) of 15 minutes. Which solution should the company use?

Accepted Answer

Configure an RDS Multi-AZ DB cluster with a standby instance in another Region.. Option D is correct because a Multi-AZ DB cluster with standby in another Region provides synchronous replication and fast failover, achieving low RPO/RTO. Option A is wrong because RDS Read Replicas are asynchronous and cross-Region replication has higher RPO. Option B is wrong because restoring from snapshots takes longer than 15 minutes. Option C is wrong because EC2 Auto Scaling groups do not handle database replication.

Answer

Use EC2 Auto Scaling to launch new instances in another Region and use an Application Load Balancer.

Answer

Take automated snapshots of the RDS instance every 5 seconds and copy them to another Region.

Answer

Deploy RDS Read Replicas in another Region and promote them during a disaster.

Question 5

An ALB is configured with a target group for HTTP:80. The health check returns a 302 redirect. What is the most likely cause of the unhealthy instances?

Accepted Answer

The application is redirecting health checks to another URL.. Option C is correct because a 302 redirect indicates the application is redirecting health checks, which is not expected. Option A is wrong because 302 is not a timeout. Option B is wrong because 302 is not a 4xx error. Option D is wrong because 302 is a redirect, not a 5xx.

Answer

The application is returning a 500 Internal Server Error.

Answer

The application is taking too long to respond.

Answer

The security group is blocking health check traffic.

Question 6

A company is designing a new application that requires a fully managed NoSQL database with single-digit millisecond latency. The application needs to handle sudden spikes in read traffic without manual intervention. Which AWS service should the company choose?

Accepted Answer

Amazon DynamoDB. DynamoDB is a fully managed NoSQL database with single-digit millisecond latency and supports auto-scaling to handle traffic spikes. Option A (Aurora) is relational and not NoSQL. Option B (ElastiCache) is a caching layer, not a primary database. Option C (RDS) is relational. Option D is correct.

Answer

Amazon RDS for MySQL

Answer

Amazon ElastiCache

Answer

Amazon Aurora

Question 7

A company is designing a new batch processing system that processes large files from Amazon S3. The processing is CPU-intensive and can take up to 2 hours per file. The company wants to minimize cost and avoid idle compute capacity. Which THREE components should the architect include? (Choose THREE.)

Accepted Answer

EC2 Spot Instances to reduce compute costs.. AWS Batch (option A) manages job scheduling and scaling. Spot Instances (option C) reduce cost. S3 Event Notifications (option D) trigger jobs when files arrive. Option B (Auto Scaling) is less efficient. Option E (Lambda) has a 15-minute limit.

Answer

AWS Lambda functions to process each file.

Answer

Auto Scaling group with scheduled scaling policies.

Question 8

A company is designing a new application that will run on Amazon EKS. The development team wants to deploy containers in a way that minimizes operational overhead. Which compute option should the company choose?

Accepted Answer

AWS Fargate. Option A is correct because Fargate is serverless and minimizes operational overhead. Option B is wrong because managed node groups still require node management. Option C is wrong because self-managed nodes have high overhead. Option D is wrong because EC2 instances require full management.

Answer

Amazon EKS managed node groups

Answer

Amazon EC2 instances

Answer

Self-managed EC2 nodes

Question 9

A company is designing a new microservices architecture using Amazon ECS with Fargate. Each service must be isolated within its own VPC and communicate via AWS PrivateLink. The company expects variable traffic and wants to minimize costs. Which solution meets these requirements?

Accepted Answer

Use separate VPCs per service and create VPC endpoint services for each.. Option D is correct because using VPC endpoints per service provides isolated connectivity without internet gateways or NAT gateways, reducing costs. Option A is wrong because a shared VPC compromises isolation. Option B is wrong because NAT gateways incur costs and are not needed for PrivateLink. Option C is wrong because Transit Gateway adds cost and complexity.

Answer

Use separate VPCs and connect them via VPC peering with NAT gateways.

Answer

Deploy all services in a single VPC with security groups to isolate traffic.

Answer

Use a single VPC with Transit Gateway to route between services.

Question 10

A company is designing a new application that processes sensitive healthcare data. The application runs on Amazon ECS with Fargate and uses an Application Load Balancer. The company must ensure that all data in transit is encrypted. Which step should be taken?

Accepted Answer

Configure the ALB listener to use HTTPS (port 443) with an SSL certificate.. Option A is correct. A listener on port 443 with an SSL certificate encrypts traffic between clients and the ALB. Option B is wrong because the security group does not encrypt traffic. Option C is wrong because HTTPS is needed at the ALB. Option D is wrong because the target group protocol should be HTTPS if encryption is required end-to-end, but the question asks for data in transit from clients.

Answer

Configure the target group to use HTTP protocol.

Answer

Configure the security group to only allow inbound traffic from approved IPs.

Answer

Use HTTP on port 80 and rely on VPC network ACLs.

Question 11

A company is designing a disaster recovery (DR) solution for a critical application running on Amazon EC2 instances in a single AWS Region. The DR site will be in a different Region. The application data is stored in an Amazon RDS for MySQL DB instance with Multi-AZ enabled. The Recovery Point Objective (RPO) is 15 minutes, and the Recovery Time Objective (RTO) is 2 hours. Which strategy meets these requirements MOST cost-effectively?

Accepted Answer

Configure a cross-Region read replica for the RDS MySQL DB instance. In the DR event, promote the read replica to a standalone instance.. Option C is correct because a read replica in another Region provides an RPO of seconds and an RTO of minutes when promoted, and it is low cost. Option A is wrong because cross-Region snapshots have longer RPO (daily) and RTO (hours). Option B is wrong because Aurora Global Database is more expensive and not MySQL-compatible. Option D is wrong because EC2 Image Builder does not address database replication.

Answer

Take daily automated snapshots of the RDS DB instance and copy them to the DR Region. In the DR Region, restore the DB instance from the latest snapshot.

Answer

Use Amazon Aurora Global Database to replicate data across Regions.

Answer

Use AWS Backup to copy backups to the DR Region and set up EC2 Image Builder for application recovery.

Question 12

A company is designing a new microservices architecture on Amazon ECS with Fargate. Each microservice must be isolated and able to communicate with others only through defined APIs. Which solution provides the BEST isolation and security?

Accepted Answer

Use AWS App Mesh with Envoy sidecars to control traffic between services.. Using a service mesh like App Mesh (option C) provides fine-grained traffic control and security between microservices. Option A (same security group) is too permissive. Option B (ALB per service) adds complexity. Option D (VPC peering) is for VPC-level, not service-level.

Answer

Place all microservices in the same security group and allow all traffic.

Answer

Use an Application Load Balancer per microservice with listener rules.

Answer

Use VPC peering between each microservice's VPC.

Question 13

An IAM policy is attached to an IAM user. The user tries to download an object from S3 bucket 'example-bucket' from an IP address 10.0.1.5. What will happen?

Accepted Answer

The request is allowed.. The policy grants s3:GetObject only if the source IP is in 10.0.0.0/16. Since 10.0.1.5 is within that range, the request is allowed. Option A is correct. Option B would be true if IP outside range. Option C (deny) would override. Option D (no effect) is incorrect.

Answer

The policy has no effect because the condition is invalid.

Answer

The request is denied unless there is another explicit deny.

Answer

The request is denied.

Question 14

A solutions architect runs the above CLI command. What is the output format?

Accepted Answer

A JSON array of strings.. The command uses --query with JMESPath to output specific fields as a JSON array. Option A is correct. Options B, C, D are incorrect because the query specifies an array output.

Answer

YAML formatted output.

Answer

A text table with columns.

Answer

A JSON object with keys.

Question 15

A company is designing a new application that requires low-latency access to a shared dataset across multiple EC2 instances in the same AWS Region. The dataset is updated frequently. Which storage solution should the company use?

Accepted Answer

Amazon EFS. Option C is correct because Amazon EFS provides a shared file system with low latency and is accessible from multiple EC2 instances. Option A is wrong because EBS volumes can only be attached to one instance at a time (unless using Multi-Attach, which has limitations). Option B is wrong because S3 is object storage, not file storage. Option D is wrong because S3 Glacier is for archival.

Answer

Amazon S3

Answer

Amazon EBS with Provisioned IOPS

Answer

Amazon S3 Glacier